Exchange IMF Effectiveness

I'd like to report the results of a short and not-very-scientific, but
practical, test of the effectiveness of Exchange 2003 SP2's Intelligent
Message Filter, and see if the results are broadly comapartive with
others' experience.

Our setup is as follows:

- Sender filtering mostly not used (but for filtering messages with
blacnk sender);
- Connection filtering on, using SpamCop;
- Recipient filtering not used;
- Sender ID filtering set to pass sender ID status to IMF; and
- IMF configured for a gateway blocking level of 8 (and set to archive
blocked messages), and junk e-mail trapping at level 4. Setting this
latter threshold to less than 4 causes too many False Positives (FPs)
for our liking.

On the clients we already have Cloudmark Desktop, so it can filter
whatever spam IMF misses. Over a near-three day period we can summarise
results thus:

- IMF archived a total of 516 messages.
- IMF directed a further 73 messages to users' junk e-mail folders.
- Cloudmark filtered 179 messages on the clients missed by IMF.
- A total of 8 spam messages were missed by IMF and Cloudmark.
- There were no FPs.

IMF therefore filtered approx 76% of spam. When Cloudmark is used
exclusively on clients (without IMF being used), Cloudmark consistently
filters 98% of spam we receive.

Now, let me say that catching 76% of spam is A GOOD THING (especially
given the attractive cost of IMF). That said, IMF's effectiveness
compared with commercial third party solutions is somewhat lacking.
We'd like to drop third party solutions altogether, but not at the cost
of 24% of spam getting through. Or am I expecting too much?

--
Regards,
Steve.
.

Relevant Pages

  • Re: Distribution Group
    ... SPAM that has been filtered in case a legitimate email happens to get ... That's when you can whitelist them using IMF. ... We are using only the Intelligent Email Filtering that came with ... We are using Exchange 2003 ...
    (microsoft.public.windows.server.sbs)
  • Re: Whats your opinion on IMF?
    ... The server-side filtering from IMF is not as good as Outlook's Junk ... Thus, for Blackberry and OWA users, the IMF is not the ... Blackberry users were still plagued with the same amount of spam. ...
    (microsoft.public.windows.server.sbs)
  • Re: Exchange IMF Effectiveness
    ... IMF Tune - Unleash the Full Intelligent Message Filter Power ... Sender filtering mostly not used (but for filtering messages with ... Cloudmark filtered 179 messages on the clients missed by IMF. ... A total of 8 spam messages were missed by IMF and Cloudmark. ...
    (microsoft.public.windows.server.sbs)
  • Re: Change user email name only
    ... Set that IMF to reject otherwise you are going to get users fussing ... given up on IMF and let our Trend AV do the spam filtering. ... That folder auto empties at a default of 14 days so it only gets so ...
    (microsoft.public.windows.server.sbs)
  • Re: Does IMF really do the job?
    ... hosted service and IMF, right? ... SCLs on my regular email (I've only been at my current job for three months, ... but get no spam on my work email address, because almost no one has it and I ... how filtering affects it. ...
    (microsoft.public.exchange.admin)